CVE-2009-0481: XSS

Published Feb 9, 2009

Updated

Bugzilla 2.x before 2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote authenticated users to conduct cross-site scripting (XSS) and related attacks by uploading HTML and JavaScript attachments that are rendered by web browsers.

Affected Software

76 affected components

Bugzilla=3.0.4

Bugzilla=2.16.8

Bugzilla=3.0.0

Bugzilla=2.16_rc2

Bugzilla=3.0.1

Bugzilla=2.18.8

Bugzilla=2.17.6

Bugzilla=2.18.5

Bugzilla=2.19.3

Bugzilla=2.20-rc2

Bugzilla=2.18.6

Bugzilla=2.17.2

Bugzilla=2.20-rc1

Bugzilla=2.16.1

Bugzilla=2.20

Bugzilla=2.19

Bugzilla=2.18-rc1

Bugzilla=2.16.2

Bugzilla=2.16.11

Bugzilla=2.20.5

Bugzilla=2.20.6

Bugzilla=2.22.3

Bugzilla=2.22.6

Bugzilla=2.17.4

Bugzilla=2.16-rc1

Bugzilla=2.21.2

Bugzilla=2.10

Bugzilla=2.17.1

Bugzilla=2.16

Bugzilla=2.22.1

Bugzilla=2.16.9

Bugzilla=3.0.6

Bugzilla=2.20.1

Bugzilla=2.14.2

Bugzilla=2.18.7

Bugzilla=2.22.2

Bugzilla=2.18.1

Bugzilla=2.22-rc1

Bugzilla=2.14.3

Bugzilla=2.22.5

Bugzilla=2.14.4

Bugzilla=2.19.1

Bugzilla=2.16.7

Bugzilla=2.17.5

Bugzilla=2.22

Bugzilla=2.17.3

Bugzilla=2.16.4

Bugzilla=2.12

Bugzilla=3.0.3

Bugzilla=3.2

Bugzilla=2.20.3

Bugzilla=3.0.2

Bugzilla=2.18.4

Bugzilla=2.16.3

Bugzilla=2.14.5

Bugzilla=2.18.9

Bugzilla=2.18

Bugzilla=2.18.3

Bugzilla=2.17.7

Bugzilla=2.20.2

Bugzilla=2.20.4

Bugzilla=2.21.1

Bugzilla=2.18-rc3

Bugzilla=2.17

Bugzilla=2.16.6

Bugzilla=2.18.2

Bugzilla=2.18-rc2

Bugzilla=3.0.5

Bugzilla=2.14.1

Bugzilla=2.22.4

Bugzilla=2.21

Bugzilla=2.16.5

Bugzilla=3.3.1

Bugzilla=2.14

Bugzilla=2.19.2

Bugzilla=2.16.10

Event History

Feb 9, 2009

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Data Sourced

via NVD·05:30 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2009-0481?

CVE-2009-0481 has a medium severity level due to the potential for cross-site scripting attacks.

How do I fix CVE-2009-0481?

To fix CVE-2009-0481, upgrade Bugzilla to version 3.0.7 or later, or apply the appropriate patches provided by the vendor.

What versions of Bugzilla are affected by CVE-2009-0481?

CVE-2009-0481 affects Bugzilla versions 2.x before 2.22.7 and 3.x before 3.0.7, including specific intermediate versions.

What types of attacks can be conducted due to CVE-2009-0481?

CVE-2009-0481 allows remote authenticated users to perform cross-site scripting (XSS) attacks and related exploits by uploading malicious HTML and JavaScript files.

Who is impacted by CVE-2009-0481?

Users of affected versions of Bugzilla, particularly those allowing file uploads from authenticated users, are impacted by CVE-2009-0481.